[FLINK-40459][build] Bump Maven from 3.8.6 to 3.9.16

[MartijnVisser]

What is the purpose of the change

Bumps the build/enforced Maven version from 3.8.6 to 3.9.16.

Brief change log

• pom.xml: the enforce-maven execution's requireMavenVersion pin goes from [3.8.6] to [3.9.16] (exact pin retained, no other enforcer rule touched)
• .mvn/wrapper/maven-wrapper.properties: distributionUrl and distributionSha256Sum updated to Apache Maven 3.9.16 (the wrapperUrl/wrapperSha256Sum for maven-wrapper 3.3.2 stay as they are)
• README.md: documented required Maven version updated to 3.9.16
• AGENTS.md: documented prerequisite Maven version updated to 3.9.16
• docs/content/docs/dev/configuration/maven.md and docs/content.zh/docs/dev/configuration/maven.md: documented Maven version updated to 3.9.16
• .github/workflows/docs.sh: the three bare mvn invocations now use the Maven wrapper ./mvnw

On the last point: the apache/flink-ci-docker:...maven_386_jammy image tags are deliberately left unchanged. All CI compile/test paths already build through the wrapper (tools/ci/maven-utils.sh -> ./mvnw, used by .github/actions/run_mvn), so the image's baked-in Maven is unused there. docs.sh (run inside that image by docs.yml and docs-legacy.yml) was the only remaining bare-mvn consumer, so switching it to the wrapper lets this bump land self-contained, without requiring a new flink-ci-docker image first. Release scripts under tools/releasing/ keep using the system mvn.

Verifying this change

This change is a trivial rework / code cleanup without any test coverage.

It was validated with a local red/green differential (3.8.6 vs 3.9.16) on JDK 17 and JDK 11, covering the full flink-dist reactor plus a Java 11 -Prelease build. The comparison showed byte-identical shaded uber-jar contents, byte-identical dependency-reduced POMs, and byte-identical aggregated NOTICE files.

That specifically re-validates the maven-shade / immutable-dependency-tree concern from the Flink "Dependencies" wiki page, which is the historical reason Flink's Maven version was pinned so conservatively: since Maven 3.3 the dependency tree is immutable during a build, so bundled dependencies can leak as transitives unless they are marked optional. tools/ci/verify_bundled_optional.sh guards that invariant and also runs through the wrapper in CI, so it re-validates the bundled/optional marking on 3.9.16 as well.

The only artifact-level difference found is that the published flink-parent pom no longer re-inlines the release-profile plugin configuration it inherits from Apache Parent POM 35. This was verified to be cosmetic: downstream effective POMs are byte-identical either way, cross-checked against the published flink-parent-2.3.0.pom.

Two known benign warnings appear on 3.9 and are not introduced by this change:

• a Maven-4 testCompileSourceRoots deprecation warning (FLINK-39565 territory)
• the pre-existing maven-gpg-plugin 1.4 gpgArguments warning (a separate JIRA will follow)

Local verification run for this PR, all passing:

• ./mvnw -version downloads Apache Maven 3.9.16 with the wrapper's own SHA-256 verification
• ./mvnw -N clean validate -> enforcer passes
• negative check with a system Maven 3.8.6: mvn -N validate now fails with Detected Maven Version: 3.8.6 is not in the allowed range [3.9.16,3.9.16]
• shading-heavy smoke build: ./mvnw clean install -DskipTests -pl flink-filesystems/flink-s3-fs-hadoop -am
• fast full-reactor build: ./mvnw clean install -DskipTests -Dfast -Pskip-webui-build -T1C

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): no
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? The existing documentation references to the required Maven version are updated in this PR

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Claude Opus 5)

[flinkbot]

CI report:

• 98cdae4 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[snuyanzin]

since you are here, should we bump maven-wrapper to 3.3.4?

[MartijnVisser]

Yep, done :)

[Copilot]

Pull request overview

Updates Apache Flink’s enforced build Maven version to 3.9.16, aligning the Maven Enforcer rule, Maven Wrapper distribution, CI docs workflow usage, and all documented prerequisites.

Changes:

• Bump the Maven Enforcer requireMavenVersion pin to [3.9.16].
• Update Maven Wrapper distribution URL and SHA-256 to Maven 3.9.16.
• Update docs and CI docs build script to consistently use the wrapper (./mvnw) and reflect the new required Maven version.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates the documented required Maven version to 3.9.16.
pom.xml	Enforces Maven 3.9.16 via the Maven Enforcer plugin.
docs/content/docs/dev/configuration/maven.md	Updates English docs requirement to Maven 3.9.16.
docs/content.zh/docs/dev/configuration/maven.md	Updates Chinese docs requirement to Maven 3.9.16.
AGENTS.md	Updates AI agent prerequisites to Maven 3.9.16.
.mvn/wrapper/maven-wrapper.properties	Points Maven Wrapper distribution to Maven 3.9.16 with updated SHA-256.
.github/workflows/docs.sh	Switches remaining mvn invocations to ./mvnw for docs CI.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.